Data processing agents: what controller, processor, and DPO mean under the LGPD

In a data committee meeting, legal asked a simple question: who here is the controller and who is the processor of the customer master? Silence in the room. Nobody could answer with confidence, even though everyone worked with that master every day.

Data processing agents are the people or companies that the LGPD (Brazil's General Data Protection Law) holds accountable for what happens to personal data, from the moment it enters the master record until the day it is deleted. The law defines three roles: controller, processor, and data protection officer. Understanding the difference between them is not a law-firm exercise. It is the foundation of any data governance program that takes the LGPD seriously, because each role carries a different responsibility, and getting the definition of who is who wrong is expensive in the event of an incident.

What data processing agents are

The General Data Protection Law separates those who decide about processing from those who merely carry it out. The controller makes the decisions about the purpose and means of processing personal data. It is the company that decides why it will collect a customer's CPF (Brazil's individual taxpayer ID), what it will use a supplier's address for, how long it will keep that data. The processor handles personal data on behalf of the controller, following the instructions it receives. It is the data enrichment company that validates a CNPJ (Brazil's company registration number) with the Receita Federal (Brazil's federal tax authority) at the customer's request, the cloud provider that hosts the database, the consultancy that performs data cleansing on a materials and customers database.

The data protection officer (DPO) is the person appointed by the controller to act as a bridge between the company, the data subjects, and the Autoridade Nacional de Proteção de Dados, the ANPD (Brazil's data protection authority). The DPO does not decide the purpose or carry out the processing. Their role is to advise, receive complaints, and make sure internal rules are followed.

This distinction explains why the same company can be a controller in one relationship and a processor in another. A master data platform you hire for data cleansing is a processor of your data. But if it uses part of that data to train its own product and decides this on its own, without instruction from the customer, it becomes the controller of that specific use. That boundary is where most companies get lost.

How accountability shows up in master record practice

Think of a common procurement scenario. The company hires a supplier approval system that automatically checks registration status with the Receita Federal, checks for administrative sanctions, and cross-references data against compliance lists. The hiring company decides which sources to check and how often: it is the controller. The vendor of the approval system, which runs those checks following the rules defined by the customer, is the processor.

Now think of a master data project in SAP. The IT area defines that the customer master will be enriched with geolocation data to improve delivery logistics. The company is the controller of that decision. If it hires a consultancy to implement that routine in SAP Master Data Governance, the consultancy acts as a processor as long as it follows the instructions received. If the consultancy decides, on its own initiative, to use that same geolocation data to build a market intelligence product and sell it to other customers, it stopped being a processor and became the controller of that new use, without authorization.

The LGPD provides for joint liability between controller and processor when they cause harm to the data subject, and the ANPD has reinforced that enforcement in its 2025 and 2026 regulatory agenda, focusing on holding accountable agents that do not adopt adequate security measures. Outsourcing the processing does not outsource the responsibility. If the processor leaks the data because of a security failure, the controller answers too, because it chose that vendor.

Who is responsible for this inside the company

Classifying the processing agents is not an isolated task for legal. It is joint work among legal, the data protection officer (DPO), the governance area, and the owners of each data domain, the data owners of customers, suppliers, and materials. Legal interprets the law and evaluates contracts. The DPO centralizes the mapping and handles the channels with the ANPD and with data subjects. The data governance area translates that classification into process: which system processes which data, for what purpose, under whose instruction.

Data stewards come in because they are the ones who know, in practice, where the data travels. A customer master data steward knows that the CRM exchanges information with the billing platform, that the billing platform is a processor, and that this contract needs a data protection clause compatible with the role it plays. Without that mapping, the company signs contracts with technology vendors without knowing whether it is hiring an ordinary processor or opening the door to an independent controller.

Which tools help map and control this

Mapping processing agents depends on knowing where the data is and who touches it. Data catalog and data lineage tools, such as Microsoft Purview, Collibra, and Alation, help visualize the path of personal data between systems and point out where a third party enters the chain. Master Data Management platforms, such as SAP Master Data Governance, Informatica, Stibo Systems, Reltio, Semarchy, Profisee, and Ataccama, centralize the customer, supplier, and material master and allow you to record, by domain, who the responsible internal controller is and which external integrations process that data.

None of these tools solves the legal classification of controller and processor on its own. That remains a human decision, based on contract and purpose. What technology solves is traceability, and without it the company has no way to honestly complete a data protection impact assessment or respond quickly when the ANPD asks.

How to learn to apply this in data governance

The most direct path is to understand the LGPD in practice, not just the text of the law. That includes studying the DAMA-DMBOK concepts on governance and data ownership, which speak directly to the roles of controller and processor, and pursuing certifications such as DAMA's CDMP, which covers privacy and data protection within the broader discipline of data management. It is also worth reviewing, case by case, the contracts the company already has with technology, cloud, and outsourcing vendors, because theory only becomes competence when applied to the real master record.

The opportunities this knowledge opens

Professionals who deeply understand data processing agents become a bridge between legal and operations, a rare and valued role. Data protection officers, senior data stewards, governance analysts, and privacy consultants with technical mastery of master records are among the most sought-after profiles as the ANPD expands enforcement and fines increase. Companies that used to treat the LGPD as a legal checklist now need people who can classify data, map the flow between systems, and justify, with evidence, why each vendor is a processor and not an independent controller.

Main questions about data processing agents

What is the difference between a controller and a processor? The controller decides the purpose and means of processing. The processor carries it out following the controller's instructions. The same company can be the controller of one piece of data and the processor of another.

Is the "encarregado de dados" the same as the DPO? Yes. Encarregado is the LGPD's term in Portuguese, DPO is the English acronym for Data Protection Officer. The role is to be the channel between the company, data subjects, and the ANPD.

Can a company be a controller and a processor at the same time? It can, and it is common. It depends on the context of each processing activity, not on the company as a whole. That is why the mapping has to be done by data flow.

What happens if the processor leaks data on its own? The LGPD provides for joint liability. The controller may answer along with it, especially if it did not assess the vendor's security guarantees before hiring.

How does the company prove who is the controller and who is the processor in an ANPD proceeding? With a formal contract that defines each party's role and with traceability of the data across systems, which requires a minimum of governance and cataloging implemented before the incident.

MDM Academy: where to learn data governance in practice

MDM Academy is 4MDG's data governance and master data school. It was born from the realization that most data courses in Brazil talk about technology and forget about the master record, governance, and the legal responsibility that structures all of it. At MDM Academy, professionals learn to classify data, build a responsibility matrix, build a governance policy, and understand how the LGPD applies to the customer, supplier, and material master, always with real company examples.

Those who want to go beyond courses can join the Data Club, the community of master data and governance professionals that exchanges experience and closely follows the regulatory changes affecting people who work with master data in Brazil. It's worth getting to know MDM Academy and seeing whether it makes sense for the moment your career or your team is in.

Conclusion

Classifying who is the controller, who is the processor, and who is the DPO looks like a bureaucratic exercise until the day a data incident happens and someone has to explain, with proof in hand, who was responsible for what. Companies that treat that classification as part of data governance, and not as a contract appendix nobody reads, arrive better prepared for that day. And, as a bonus, they build a more reliable master record along the way.

At your company, has anyone stopped to map who is the controller and who is the processor in each data contract you've signed?